Security notes
Code auditing, vulnerability analysis, network forensics and AI systems.
Selected writing
All 36 articles →PHP2Shell: I rebuilt PHP 8.3.35 and 8.3.36 to see what changed in two CVSS 9.2 RCEs
Two critical PHP runtime RCEs (CVE-2026-109618, CVE-2026-109619): root cause, the fix, and a defender-first remediation and detection guide, built from a from-source reproduction.
Vulnerability analysis · EnglishThe ARTEX Campaign: Evidence, Attribution, and Runtime Authority
An evidence-led analysis of the Korean finance disclosure: what agent artifacts can establish, what defenders should measure, and where runtime authority belongs.
AI & agent security · EnglishSecurity Boundaries, 2018–2026: What Changed and What Repeated
A technical retrospective connecting speculative execution, identity, dependency trust and agent authorization through the boundaries each system assumes.
Security research · English · Editorial draftAn Authorized Security Assessment: From Scope to a Verified Fix
A complete assessment workflow using a synthetic document service: scope, trust boundaries, test controls, evidence, remediation and retesting.
Assessment methods · English · Editorial draftActive Directory Assessment Through Attack-Path Evidence
A read-only approach to assessing identity control paths, Kerberos evidence, delegation, and certificate enrollment without overstating what configuration proves.
Internal security · English · Editorial draftAgent Authorization Must Survive the Trip from Intent to Execution
A synthetic document-export workflow shows why task grants, resource-bound approvals, and execution-time state checks belong outside the model.
AI & agent security · English · Editorial draft